Yes, we worked with top notch service security researchers to provide penetration testing and file quite a few CVEs. Nowadays you can consider Sandstorm hardened. Recently, there’s a thing they write up by Stripe to who covered this Sandstorm deployment story in Taiwan. It’s Free Software, capital F, you can set up your own Sandstorm instance with the same self service infrastructure.